B33F

**Nome do software vulnerável e versões afetadas** EasyFTP versão 1.7.0.2 **Descrição** Foi encontrada uma falha crítica no componente MKD Command Handler, que pode ser explorada remotamente. A manipulação leva a um estouro de buffer. **Recomendações** Para o EasyFTP versão 1.7.0.2, no momento, não há informações sobre uma versão mais recente que contenha uma correção para essa vulnerabilidade.

**Name of the Vulnerable Software and Affected Versions** Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 **Description** The Secondary Logon Service in Microsoft Windows does not properly process request handles, allowing local users to gain privileges via a crafted application. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator, then install programs, view, change, or delete data, or create new accounts with full user rights. To exploit this vulnerability, an attacker would first have to log on to the system. **Recommendations** For Microsoft Windows versions Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511, consider disabling the Secondary Logon Service as a temporary workaround until a patch is available. Restrict access to the system to minimize the risk of exploitation. Avoid using crafted applications that could exploit the vulnerability in the Secondary Logon Service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.